HIPAA Compliant Telehealth Platforms for Therapists

Search for HIPAA compliant telehealth platforms and you'll mostly find ranked lists. A ranking can't tell you whether a tool fits your practice, because no platform is HIPAA compliant on its own. HHS doesn't certify software, and the companies say so themselves: Google notes that HHS "doesn't offer a certification program for HIPAA compliance" (Google), and Microsoft says that using its services "doesn't on its own achieve HIPAA compliance" (Microsoft). A platform supports your compliance by signing a Business Associate Agreement (BAA) and giving you the right safeguards. Your telehealth is compliant when that agreement is in place and you set up and use the tool with care.

This guide gives you what you need to judge any option yourself: what HIPAA actually asks of a video platform, a checklist for comparing telehealth platforms for therapists, 13 questions you can email to any vendor, a test session to run before your first client, and the three kinds of platforms therapists choose between, described from each company's own documentation. We don't rank named products. At the end you'll see how TranqBay handles video sessions, since it is one of the options.

What "HIPAA compliant" means for a telehealth platform

HIPAA has no official list of video apps you may use. It has rules for you, if you are a covered entity, and for the vendors who handle protected health information (PHI) for you, called business associates. In practice, a telehealth platform is fit for HIPAA work when five things are true.

1The vendor signs a Business Associate Agreement

This is the line HHS draws most clearly. Its telehealth site says covered providers "must use technology vendors that comply with the HIPAA Rules and will enter into HIPAA business associate agreements in connection with the provision of their video communication products or other remote communication technologies for telehealth" (telehealth.hhs.gov).

A BAA isn't a badge. It's a contract with required terms. Under 45 CFR 164.504(e), the vendor must agree, among other things, to:

HHS publishes sample BAA provisions if you want to compare a vendor's wording with the standard. Vendors offer their BAAs in different ways: accepted online in an admin console, generated in account settings, sent on request, or built into the terms of service. Whatever the method, keep a copy or a dated screenshot with your practice records.

You may hear that a video service is "just a conduit" and doesn't need a BAA. HHS's conduit idea covers services that only transmit information, like a phone company carrying a call. Its audio-only telehealth guidance says a covered entity "must enter into a BAA with a vendor that is more than a mere conduit for PHI," and gives the example of an app that stores recordings or transcripts in its cloud. Video platforms usually hold accounts, schedules, chat, logs or recordings too. Don't build your compliance on the conduit exception; use a vendor that signs a BAA.

2Encryption in transit, and at rest for anything stored

The Security Rule's transmission security standard asks you to "guard against unauthorized access to electronic protected health information that is being transmitted over an electronic communications network" (45 CFR 164.312(e)). Encryption is listed as "addressable," which doesn't mean optional. Under 45 CFR 164.306(d)(3) you must assess whether it is reasonable and appropriate, and either implement it or document why not and use an equivalent measure. For video over the internet, it's hard to make a case against encryption in transit. Anything the platform stores, such as recordings, chat logs or uploaded files, should be encrypted at rest as well.

"End-to-end encryption" is a narrower claim: only the participants' devices can decrypt the call, not the vendor's servers. HIPAA doesn't name it as a requirement. On some platforms it's a separate mode that switches off features such as cloud recording, so if a vendor uses the phrase, ask exactly what it covers and when it applies.

HHS published a proposed update to the Security Rule on January 6, 2025 that would, among other changes, make encryption of electronic PHI required rather than addressable. As of this writing it hasn't been finalized, so the current rule applies.

3Access controls you can actually use

The technical safeguards in 164.312 include unique user identification (required), automatic logoff (addressable) and procedures to verify that a person seeking access "is the one claimed." On a telehealth platform that means:

Access also works at the level of each session: a waiting room or admit button so nobody enters until you let them in, and links that can't be reused by the wrong person.

4Audit records

The audit controls standard asks for "mechanisms that record and examine activity in information systems that contain or use electronic protected health information" (164.312(b)). For a video platform, that means a log of sign-ins, who joined which session and when, and changes to account settings. Ask whether you can see the log yourself or must request it, and how long it is kept.

5A clear answer on recordings, transcripts and chat

HHS's audio-only guidance names the risk directly: PHI "created or stored as a result of a telehealth session" (it gives session recordings and transcripts as examples) "could be accessed by an unauthorized third party." Before your first session, know whether the platform records, transcribes or saves chat, whether those features are on by default, where the files go (the vendor's cloud, your computer, a linked drive), who can open them, how long they're kept, and whether the BAA covers them. Many therapists don't record sessions at all. If you do, get written consent and check your state's recording law.

What stays your job

Know whether you're a covered entity. HIPAA covers health care providers "only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard," such as billing insurance electronically (HHS, Covered Entities and Business Associates). A therapist who sees only private-pay clients, with nobody billing insurance for them, may not be one. Privacy still isn't optional: state law applies, and the ACA Code of Ethics asks counselors to "use current encryption standards within their websites and/or technology-based communications that meet applicable legal requirements" (H.2.d). Many therapists follow HIPAA either way. If you aren't sure, ask a healthcare attorney.

Do a risk analysis. It is a required part of the Security Rule: "an accurate and thorough assessment of the potential risks and vulnerabilities" to electronic PHI (45 CFR 164.308). HHS describes the rule as "flexible, scalable, and technology neutral" (Summary of the HIPAA Security Rule), so a solo practice's analysis can be short. HHS and ONC publish a Security Risk Assessment Tool for small practices.

Handle the parts no platform can. A private room, a locked device, a telehealth consent, and a plan for emergencies. These come up again in the checklist below.

The COVID-era flexibility ended in 2023

In March 2020, HHS's Office for Civil Rights (OCR) said it would not penalize good-faith telehealth through "any non-public facing remote communication product," naming Apple FaceTime, Facebook Messenger video chat, Google Hangouts video, Zoom and Skype. Public-facing apps such as Facebook Live, Twitch and TikTok were never allowed. The notice also listed vendors that said they would sign a BAA, with the caution that "OCR has not reviewed the BAAs offered by these vendors" (Notification of Enforcement Discretion for Telehealth).

That notice expired at 11:59 pm on May 11, 2023, with the end of the COVID-19 public health emergency. OCR gave a 90-day transition period that ended at 11:59 p.m. on August 9, 2023 (HHS press release, April 11, 2023). If you started seeing clients online in 2020 with a tool you never signed a BAA for, that flexibility is over. Guides written in 2020 still turn up in search, and they describe rules that no longer apply.

A checklist for comparing telehealth platforms

Use this on every option, including the one you already have. A "no" isn't always a dealbreaker, but you want to find it before a client is waiting.

Questions to send a vendor before you sign up

A sales page can say "HIPAA compliant" without saying what that covers. A short email gets you the details in writing. Copy this, fill in the brackets, and keep the reply with your records.

Run a test session before your first client

A demo shows you the platform at its best. A test session shows you what your clients will meet. Use a second email address and invented names, never a real client's, and give yourself 15 minutes.

Keep a record of what you compared and why you chose. HIPAA asks you to keep Security Rule documentation, including your risk analysis, for six years from when it was created or last in effect (45 CFR 164.316), so this belongs in the same folder.

Three kinds of telehealth platforms

Most options fall into one of three groups. They differ less in whether a BAA is available than in how much of your practice they hold.

General video tools with a BAA

These are video meeting tools from large office and communication suites. Each offers a BAA, on its own terms.

Where they fit: you already run your email and calendar on the suite, and you're comfortable managing settings. What you still manage: meeting links and invites, the settings for each meeting, and a separate booking system and note system, each needing its own BAA.

Dedicated telehealth tools

These are built for one-to-one clinical visits rather than office meetings, often around a virtual waiting room and a link the client opens. Two that appear in many comparisons, both on HHS's 2020 vendor list:

Where they fit: you want a simple, focused video room and already have booking and notes elsewhere. What you still manage: getting each client the right link at the right time, and moving session details into your notes, unless the tool connects to your other software.

All-in-one practice software

These put booking, video sessions, notes, forms and often payments in one account under one vendor's BAA. The questions change a little:

Where they fit: you're starting a practice, or you're tired of copying the same details between three tools. Our guide to starting as a private practice therapist covers the other setup decisions. What you still manage: your own settings, your risk analysis, and the parts of the practice you keep outside the software.

Which kind fits your practice

How video sessions work in TranqBay

TranqBay is practice software for therapists in private practice: a practice website, online booking, video sessions, session notes and client forms in one place. Here is how it handles the points in the checklist.

To see how the pieces fit before you set anything up, the sessions section of the practice site follows one session from the booking to the video call to the note. Two points carry over from the checklist. TranqBay's BAA covers TranqBay, so if you still email clients from another account, that email provider needs its own BAA with you. And licensing, the client's location and your emergency plan stay your responsibility on any platform.

Frequently asked questions about HIPAA compliant telehealth platforms

Before you choose a platform

Get the BAA first, then check the settings, run the test session, and write down what you found and why you chose. Most of the risk with telehealth sits in a few places: the agreement, the link, the recording and the client's location.

If you'd like booking, video sessions and notes in one place under one BAA, see how TranqBay works for private practice: you can look at a practice website template and the booking page your clients would use. If you're deciding whether to join, this page explains how joining TranqBay works.

Sources